MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0333182e0308aa055e926b1a7aafed8be4de7a8a4ed800aafbb24f8d9ae23547. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments 1

SHA256 hash:	0333182e0308aa055e926b1a7aafed8be4de7a8a4ed800aafbb24f8d9ae23547
SHA3-384 hash:	05b1038c8d3e427b37f05518ceb427897795014223b9b2897e9dba1e2ae23e92a8f1e1c4f294eee79f67e7958006b36a
SHA1 hash:	b9e298c443db8c1e5a17eca60e5c4d2ef7bdd519
MD5 hash:	daabb579fc48612e8c836cb82d3aa2b0
humanhash:	ohio-autumn-winner-maine
File name:	daabb579fc48612e8c836cb82d3aa2b0
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	558'592 bytes
First seen:	2021-10-03 19:39:52 UTC
Last seen:	2021-10-03 20:52:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d33805713bf84c5172011e6ee58dcc60 (6 x RedLineStealer, 2 x ArkeiStealer, 2 x RaccoonStealer)
ssdeep	12288:zLeNjTmiUjvIHfjRt0khCt7E7GWtFAZvE9GxcaUpsizxp6L:z6nmiUjvIFVCSHAZvBcaK36L
Threatray	3'429 similar samples on MalwareBazaar
TLSH	T161C4F10D35A0D7F1E6B656B16722C7F80A7EBC5C482A528F3B88275D7E383D19729306
File icon (PE):
dhash icon	fcfcf4f4d4dcd8c0 (26 x RaccoonStealer, 11 x RedLineStealer, 9 x Stop)
Reporter	zbetcheckin
Tags:	32 exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

daabb579fc48612e8c836cb82d3aa2b0

Verdict:

Malicious activity

Analysis date:

2021-10-03 19:43:04 UTC

Tags:

trojan stealer raccoon loader

Link:

https://app.any.run/tasks/fc3d5f85-94ff-4235-be84-eb5a69d3bc72

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/194378/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.3107.31804.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ab2ad2f6-b613-449c-9748-8ca91464b123

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/863517

Signature

Contains functionality to steal Internet Explorer form passwords

Creates HTML files with .exe extension (expired dropper behavior)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Self deletion via cmd delete

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0333182e0308aa055e926b1a7aafed8be4de7a8a4ed800aafbb24f8d9ae23547/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2021-10-03 19:10:29 UTC

AV detection:

25 of 45 (55.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=amzrqlqdbcvakxusnmnhvl7nrpsn46ukj3mabkx3wjhy3gxcgvdq._file

Verdict:

malicious

Label(s):

raccoon

RaccoonStealer

586e63037f6297075b488aad3e8b3c2760a1c63852cea2286f89b6ee2617f0c6

RaccoonStealer

63d9d211e1fae3e169ecd91e81e7ce5f10c43c35a2194340cbd85341dc323c4f

RaccoonStealer

678f03e1574817fdf555ebe8701534034315d008addfb0dd7aac8fd35d17e855

RaccoonStealer

89b3ed9d4b3daa09b18db0ee62d8c7b652f3101299a6fc9ca0245bb6a6ded9b9

RaccoonStealer

a60659139ff3a9e6a4a482e060e301c83a25a02227308f6f572d79cc95c63dce

RaccoonStealer

af37877133e6e656c670126e562f53e50be8867239e7e0b2beb88072ec6ea76e

RaccoonStealer

dcf0e6d3caaf3860dd95adaa7735485a708499234f26c7c31320833a442316df

RaccoonStealer

dd8fe8c0fc82e8596fba43a2f3db0c109fd6a16c150288f81e43c7b46648f288

RaccoonStealer

e93dc5ab7d1c5a90a33dd83f1930c365a6b6481496b60c5203c8277c37e9ed5c

RaccoonStealer

+ 3'419 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:�!!9fe�b[_�� {��b1*`�`�bb�n�x� discovery spyware stealer suricata

Link:

https://tria.ge/reports/211003-ydjj5afgcp/

Behaviour

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks installed software on the system

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Raccoon

suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

Unpacked files

SH256 hash:

aaef7f85bf20bd737d09583b595cbec39a541ac421a36b0b68501f01f40e99fa

MD5 hash:

ade8e6f2d256a9d9c7fba9d8bd95e92e

SHA1 hash:

2c353b1a296f159a52080ca01cb277c475be9ea6

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/8686fffd-ab71-4442-87ea-03a1e74bcce6/

Parent samples :

0333182e0308aa055e926b1a7aafed8be4de7a8a4ed800aafbb24f8d9ae23547
fcd4fec8c6c38b2ddcf5d018d8ae08a80a495477f2618b825d70820354fcbfd1
e55b2c5d2e4903c916a6b6982b7f0030ad4a4a3e0c1d3f8969e6646dafbb3c35
354efc97e4a680e6b6fceb03d31ead926205efda8d5e0f28abe1c3381aa1991a
ad7a43d349196fcd55f26cafda2ed1907288aff6200e0348718cdc94373d84b9
9fbc2a32b58c53043d6697e93642837cd2b6ab5571794149736741a4ed208a9f
7cd0e04ae6cb26444707130e0d56860e56345c9a2153078621eb7bd511ed1f29
f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5
1e89e268686b120ae6e58ebfc87c5a532d227a54c35bc3b01ed1b992503f64e2

SH256 hash:

0333182e0308aa055e926b1a7aafed8be4de7a8a4ed800aafbb24f8d9ae23547

MD5 hash:

daabb579fc48612e8c836cb82d3aa2b0

SHA1 hash:

b9e298c443db8c1e5a17eca60e5c4d2ef7bdd519

Link:

https://www.unpac.me/results/8686fffd-ab71-4442-87ea-03a1e74bcce6/

Malware family:

Raccoon v1.7.2

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/0333182e0308/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0333182e0308aa055e926b1a7aafed8be4de7a8a4ed800aafbb24f8d9ae23547

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers